From a3e5eeb94c5ae524ca5af9b39d63f21810a173f1 Mon Sep 17 00:00:00 2001 From: Eric Sandeen Date: Fri, 26 Apr 2013 16:06:04 -0500 Subject: Btrfs-progs: fix array bound checking Otherwise we can execced the array bound of path->slots[]. [Eric Sandeen: port kernel commit a05a9bb to userspace] Signed-off-by: Li Zefan Signed-off-by: Eric Sandeen Signed-off-by: David Sterba Signed-off-by: Chris Mason --- ctree.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) (limited to 'ctree.c') diff --git a/ctree.c b/ctree.c index 1a4f3f06..b07961bc 100644 --- a/ctree.c +++ b/ctree.c @@ -827,9 +827,10 @@ static int balance_level(struct btrfs_trans_handle *trans, orig_ptr = btrfs_node_blockptr(mid, orig_slot); - if (level < BTRFS_MAX_LEVEL - 1) + if (level < BTRFS_MAX_LEVEL - 1) { parent = path->nodes[level + 1]; - pslot = path->slots[level + 1]; + pslot = path->slots[level + 1]; + } /* * deal with the case where there is only one pointer in the root @@ -1019,9 +1020,10 @@ static int noinline push_nodes_for_insert(struct btrfs_trans_handle *trans, mid = path->nodes[level]; WARN_ON(btrfs_header_generation(mid) != trans->transid); - if (level < BTRFS_MAX_LEVEL - 1) + if (level < BTRFS_MAX_LEVEL - 1) { parent = path->nodes[level + 1]; - pslot = path->slots[level + 1]; + pslot = path->slots[level + 1]; + } if (!parent) return 1; -- cgit v1.2.3